Sanctions, Expulsion of Russian Diplomats in Response to Hacking, Harassment of U.S. Personnel

Russian President Vladimir Putin listens to President Obama in Hangzhou, China, on Sept. 5, 2016. (Alexei Druzhinin/Sputnik, Kremlin Pool Photo via AP)

WASHINGTON — Coinciding with a new joint analysis from the intelligence community concluding that that Kremlin was behind election-season hacking, President Obama ordered a series of punitive measures against Russia including the expansion of sanctions against several entities and individuals.

Those sanctions include two Russian intelligence services (the GRU and the FSB), the chief and three deputy chiefs of the GRU (the Main Intelligence Directorate), and three companies that supported the GRU: the Special Technology Center, Zorsecurity and the Autonomous Noncommercial Organization “Professional Association of Designers of Data Processing Systems”.

The hackers were identified as two on the FBI Cyber’s Most Wanted list: Evgeniy Mikhaylovich Bogachev, an IT professional with a $3 million reward on his head who was indicted by a federal grand jury in the District of Nebraska in 2012, and Aleksey Belan, a software programmer who has been wanted since 2012 for hacking companies in California and Nevada.

Thirty-five Russian government officials in Washington and San Francisco have also been told to pack up their bags and leave the country within 72 hours. The “persona non grata” declaration, the White House said, was in response to harassment of U.S. diplomatic personnel in Russia that “has increased significantly and gone far beyond international diplomatic norms of behavior.”

One such incident was an FSB guard attacking an American diplomat outside of the U.S. Embassy in June; Russia then aired video on state TV of the diplomat trying to crawl to the embassy door. At the time, the State Department charged that Russian security services “intensified their harassment against U.S. personnel in an effort to disrupt our diplomatic and consular operations.”

The Russians asked to leave the United States “were acting in a manner inconsistent with their diplomatic status,” the White House said. In addition, the State Department will be blocking Russian access to two Russian government-owned “recreational compounds” in Maryland and New York as of Friday at noon; the administration says Russia has been using the facilities for “intelligence-related purposes.”

In a statement, President Obama said the actions “follow repeated private and public warnings that we have issued to the Russian government, and are a necessary and appropriate response to efforts to harm U.S. interests in violation of established international norms of behavior.”

“All Americans should be alarmed by Russia’s actions,” he said. “…We will continue to take a variety of actions at a time and place of our choosing, some of which will not be publicized. In addition to holding Russia accountable for what it has done, the United States and friends and allies around the world must work together to oppose Russia’s efforts to undermine established international norms of behavior, and interfere with democratic governance.”

Obama promised a report to Congress “in the coming days about Russia’s efforts to interfere in our election, as well as malicious cyber activity related to our election cycle in previous elections.”

The Office of the Director of National Intelligence, the Department of Homeland Security and the FBI issued a joint statement today declaring that the intelligence community “is confident the Russian Government directed the recent compromises of e-mails from U.S. persons and institutions, including from U.S. political organizations, and that the disclosures of alleged hacked e-mails on sites like and WikiLeaks are consistent with the Russian-directed efforts.”

“This activity by Russian intelligence services is part of a decade-long campaign of cyber-enabled operations directed at the U.S. Government and its citizens. These cyber operations have included spearphishing, campaigns targeting government organizations, critical infrastructure, think tanks, universities, political organizations, and corporations; theft of information from these organizations; and the recent public release of some of this stolen information,” the statement said.

The intel community leaders encouraged security companies and the private sector “to look back within their network traffic for signs of the malicious activity” described in the newly released Joint Analysis Report.

The report, which outlines how the hackers gained access to U.S. systems as well as mitigation strategies for network administrators to take, refers to the Russian campaign as Grizzly Steppe.

(From DHS/FBI Grizzly Steppe Joint Analysis Report)

(From DHS/FBI Grizzly Steppe Joint Analysis Report)

“The U.S. Government confirms that two different RIS [Russian intelligence] actors participated in the intrusion into a U.S. political party,” the report states. “Both groups have historically targeted government organizations, think tanks, universities, and corporations around the world.”

Senate Foreign Relations Committee Ranking Member Ben Cardin (D-Md.), who is also ranking member on the Helsinki Commission and the driving force behind the Magnitsky Act human rights sanctions on Russia, said his congressional colleagues and the incoming administration should view the Russian attack as “a wake-up call, a political Pearl Harbor as others have noted.”‘

“Now is not the ‘time to get on with our lives,’ but to take an appropriate response in line with the ongoing threat that Russia poses to our democracy and global security interests,” Cardin said, referencing President-elect Trump’s Wednesday comments when asked about the Russian hacking and the Obama administration’s plans for sanctions.

“I think we ought to get on with our lives,” Trump said at his Mar-a-Lago estate in Palm Beach, Fla. “I think that computers have complicated lives very greatly. The whole age of the computer has made it where nobody knows exactly what’s going on. We have speed, we have a lot of other things, but I’m not sure we have the kind of security we need.”

Cardin said it’s now “imperative the legislative branch now pick up the ball and move it forward — congressional sanctions can complement and strengthen these new executive sanctions.” He said he’ll introduce two bills in January, “the first which would establish an independent, nonpartisan commission to further examine the attack and Russian’s efforts to interfere in our election.”

“The second bill will frame our policy on Russia to include comprehensive enhanced sanctions in response to Russia’s interference in our election and its ongoing aggression in Ukraine and Syria,” the senator said. “The bill will also increase assistance to bolster democratic institutions across Europe.”

House Intelligence Committee Chairman Devin Nunes (R-Calif.), who is on the Trump transition team, noted that his panel “has been urging President Obama for years to take strong action to deter Russia’s worldwide aggression, including its cyber-hacking operations.”

“Now, with just a few weeks left in office, the president has suddenly decided that some stronger measures are indeed warranted,” Nunes said. “This kind of indecision and delay helps to explain why now, at the end of Obama’s eight-year presidency, America’s influence has collapsed among both our allies and our enemies.”

Dmitry Peskov, press secretary for Russian President Vladimir Putin, said the Kremlin will respond “adequately” per Putin’s direction.

“There is no doubt that Russia’s adequate and mirror response will make Washington officials feel very uncomfortable as well,” Peskov said.